Ruleset Update Summary - 2026/07/27 - v11242

Ruleset Updates
1

Summary:

36 new OPEN, 46 new PRO (36 + 10)

Added rules:

Open:

  • 2071293 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abangan .cyou) (malware.rules)
  • 2071294 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abangan .cyou) in TLS SNI (malware.rules)
  • 2071295 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (boothroundupdow .fun) (malware.rules)
  • 2071296 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (boothroundupdow .fun) in TLS SNI (malware.rules)
  • 2071297 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (businway .cyou) (malware.rules)
  • 2071298 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (businway .cyou) in TLS SNI (malware.rules)
  • 2071299 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (citymket .cyou) (malware.rules)
  • 2071300 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (citymket .cyou) in TLS SNI (malware.rules)
  • 2071301 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (creaflow .cyou) (malware.rules)
  • 2071302 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (creaflow .cyou) in TLS SNI (malware.rules)
  • 2071303 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formiklass .fun) (malware.rules)
  • 2071304 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (formiklass .fun) in TLS SNI (malware.rules)
  • 2071305 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (futurtep .cyou) (malware.rules)
  • 2071306 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (futurtep .cyou) in TLS SNI (malware.rules)
  • 2071307 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (smaridge .cyou) (malware.rules)
  • 2071308 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (smaridge .cyou) in TLS SNI (malware.rules)
  • 2071309 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (starzone .cyou) (malware.rules)
  • 2071310 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (starzone .cyou) in TLS SNI (malware.rules)
  • 2071311 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trendion .cyou) (malware.rules)
  • 2071312 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (trendion .cyou) in TLS SNI (malware.rules)
  • 2071313 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (visioint .cyou) (malware.rules)
  • 2071314 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (visioint .cyou) in TLS SNI (malware.rules)
  • 2071315 - ET WEB_SPECIFIC_APPS Sonicwall Diagnostics page target Parameter Command Injection Attempt (CVE-2023-44221) (web_specific_apps.rules)
  • 2071316 - ET WEB_SPECIFIC_APPS SAP NetWeaver scheduler URI Directory Traversal Attempt (CVE-2017-12637) (web_specific_apps.rules)
  • 2071317 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (bauabach .lol) (exploit_kit.rules)
  • 2071318 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (chaphan .click) (exploit_kit.rules)
  • 2071319 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (bauabach .lol) (exploit_kit.rules)
  • 2071320 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (chaphan .click) (exploit_kit.rules)
  • 2071321 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (astrotg .world) (malware.rules)
  • 2071322 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (astrotg .world) in TLS SNI (malware.rules)
  • 2071323 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (milezcv .cyou) (malware.rules)
  • 2071324 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (milezcv .cyou) in TLS SNI (malware.rules)
  • 2071325 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sceeptersong .digital) (malware.rules)
  • 2071326 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sceeptersong .digital) in TLS SNI (malware.rules)
  • 2071327 - ET WEB_SPECIFIC_APPS vBulletin Unauthenticated Remote Code Execution (CVE-2026-61511) (web_specific_apps.rules)
  • 2071328 - ET WEB_SPECIFIC_APPS QNAP Malware Remover Python Code Injection (CVE-2025-11837) (web_specific_apps.rules)

Pro:

  • 2868068 - ETPRO MALWARE TA569 Gholoader CnC URI M1 (malware.rules)
  • 2868069 - ETPRO MALWARE TA569 Gholoader CnC URI M2 (malware.rules)
  • 2868070 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868071 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868072 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868073 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868074 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868075 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868076 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868077 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)